Optimised versions of the Ate and Twisted Ate Pairings
|
|
- Maximillian Thomas
- 5 years ago
- Views:
Transcription
1 Optimised versions of the Ate and Twisted Ate Pairings Seiichi Matsuda 1, Naoki Kanayama 1, Florian Hess 2, and Eiji Okamoto 1 1 University of Tsukuba, Japan 2 Technische Universität Berlin, Germany Abstract. The Ate pairing and the twisted Ate pairing for ordinary elliptic curves which are generalizations of the η T pairing for supersingular curves have previously been proposed. It is not necessarily the case that both pairings are faster than the Tate pairing. In this paper we propose optimized versions of the Ate and twisted Ate pairings with the loop reduction method and show that both pairings are always at least as fast as the Tate pairing. We also provide suitable families of elliptic curves that our optimized Ate and optimized twisted Ate pairings can be computed with half the loop length compared to the Tate pairing. 1 Introduction In 2000, Sakai et al [14] proposed an ID-based key agreement protocol using a bilinear pairing, and pairing-based cryptosystems became one of the most attractive areas of research in elliptic curve cryptography. Famous examples are Identity Based Encryption [5] and Short Signature [6]. Using a bilinear pairing, one can construct a nonconventional protocol and reduce the bandwidth. The pairing computation, however, takes up much more computational costs than main cryptographic primitives such as modular exponentiation or scalar multiplication over elliptic curves, so an efficient algorithm for computing the pairing presents an important issue in pairing-based cryptography. Some leading algorithms of computing pairing have been proposed. Such examples are an efficient algorithm called the BKLS algorithm [2] which was proposed, and the new pairing on a supersingular (hyper)elliptic curve over a finite field of characteristic p which was proposed by Duursma et al a year later [8]. Barreto et al [1] generalized this pairing over supersingular curves with trace t to be the η pairing and proposed the η T pairing, where T = t 1, that can be computed with half the loop length compared to the η pairing. For these results, they consider pairings on G 1 G 2, where G 1 = E(F q )[r], G 2 = E(F q k)[r]. Hess et al [11] extended η T pairing over an ordinary curve and proposed the Ate pairing on G 2 G 1 and the twisted Ate pairing on G 1 G 2. Note that the latter can only be faster than the Tate pairing when T e r using a twist E /F q e. In this paper, we propose an optimized version of the Ate and twisted Ate pairing which can be more efficiently computed than the standard Ate and twisted Ate pairing if certain conditions are met. We provide some families of elliptic curves for which these conditions are satisfied.
2 2 Background 2.1 Tate pairing Let F q be a finite field with q = p m elements where p is prime and let E be an elliptic curve defined over F q. Denote subgroup order by r such that r E(F q ) and the embedding degree by k such that the smallest positive integer with r q k 1. Let P E(F q )[r] and Q E(F q k), and consider the divisor D = (Q+R) (R) with R a random point in E(F q k). For every integer a, let f a,p be a function with divisor div(f a,p ) = a(p ) (ap ) (a 1)(O), then the Tate pairing is a well-defined, nondegenerate, bilinear pairing { E(F q )[r] E(F q k)/re(f q k) F q /(F, r : k q ) r k (P, Q) P, Q r = f r,p (D) We will require a unique element of F q k for pairing-based protocols, so one may define the reduced Tate pairing as e(p, Q) = P, Q (qk 1)/r r = f r,p (Q) (qk 1)/r Galbraith et al [10] shows that r can be replaced by any integer N such that r N q k 1, i.e. e(p, Q) = f N,P (Q) (qk 1)/N One can compute f r,p (Q) using Miller s algorithm. If k is even, then vertical line g ap through ap can be ignored due to the final powering operation. Miller s Algorithm INPUT: P E(F p )[r], Q E(F p k)/re(f p k) OUTPUT: f F p k f 1, V P and n = r 1 for i log 2 n 1 downto 0 do f f 2 g V,V (Q)/g 2V (Q) and V 2V if n i = 1 then f f g V,P (Q)/g V +P (Q) and V V + P return f 2.2 η and η T pairing For P E(F q )[r], Q E(F q k)[r] where E is a supersingular curve with distortion map ψ, there exists an automorphism γ such that γψ q (P ) = ψ(p ). For M = (q k 1)/N, T Z, the following equation holds: ( P, ψ(q) M N ) L = (η T (P, Q) M ) at a 1, where a N, L, c Z, T a + 1 = LN, T = q + cn. Barreto et al [1] have proposed the η pairing for T = q on the above definition and also introduced improved version of it with the choice T = q N and refer to the pairing as η T pairing. Since T = q N = t 1, the η T pairing can be computed with half the loop length compared to the η pairing. 2
3 2.3 Ate pairing Let Frobenius endomorphism π q : E E : (x, y) (x q, y q ) and let G 1 = E[r] Ker(π q [1]), G 2 = E[r] Ker(π q [q]). Denote the group order of the elliptic curve by E(F q ) = q+1 t and let T = t 1. Let N = gcd(t k 1, q k 1), T k 1 = LN. For Q G 2, P G 1, we have the Ate pairing: a T : (Q, P ) f T,Q (P ) c T (q k 1)/N where c T = k 1 i=0 T k 1 i q i kq k 1 mod r. The Ate pairing is nondegenerate for r L and bilinear. One can compute f T,Q (P ) using Miller s algorithm with loop length log 2 T. If q r and the average size of trace equals to q, the Ate pairing can be computed with half the loop length compared to the Tate pairing. 2.4 Twist Let E and E be two ordinary elliptic curves over F q with q = p n and p 5. E is called a twist of degree d of E if there exists an isomorphism ψ : E E defined over F q and d is minimal. We remark that the condition k Aut(E) holds true if and only if E admits a twist of degree k. Let D F q, then the twists corresponding to D mod (F q) d are given by d = 2 E : y 2 = x 3 + ax + b, d = 4 E : y 2 = x 3 + a/d 2 x + b/d 3, ψ : E E : (x, y) (Dx, D 3/2 y), E : y 2 = x 3 + ax, E : y 2 = x 3 + a/dx, ψ : E E : (x, y) (D 1/2 x, D 3/4 y), d = 3, 6 E : y 2 = x 3 + b, 2.5 Twisted Ate pairing E : y 2 = x 3 + b/d, ψ : E E : (x, y) (D 1/3 x, D 1/2 y). Let E be an elliptic curve admitting a unique twist E of degree m over F q e for m = gcd(k, Aut(E)) and e = k/m. One can alternatively represent G 2 as G 2 = E[r] Ker([ζ m ]πq e 1) where ζ m is the primitive mth root of unity such that [ζ m ] : (x, y) (ζmx, 2 ζmy). 3 For P G 1, Q G 2, we have the twisted Ate pairing: a twist T e : (P, Q) f T e,p (Q) c T e (qk 1)/N where c T e = m 1 i=0 T e(m 1 i) q ei kq k 1 mod r. The Ate pairing is nondegenerate for r L and bilinear. Note that this pairing can only be faster than the Tate pairing when T e r. 3
4 3 Optimized versions of Ate and twisted Ate pairings We can regard the optimized versions of Ate and twisted Ate pairing as an η T pairing. Let E be an ordinary elliptic curve over F q and let P G 1 and Q G 2 such that G 1 = E[r] Ker(π q [1]) and G 2 = E[r] Ker(π q [q]). Theorem 1. Let r 5 be the subgroup order and let S be an integer with S q mod r. Define N = gcd(s k 1, q k 1) and S k 1 = LN. Let c S = k 1 i=0 Sk 1 i q i mod N. Then a S : (Q, P ) f S,Q (P ) c S(q k 1)/N defines a bilinear pairing G 2 G 1 F q k [r]. If k Aut(E) then a twist S : (P, Q) f S,P (Q) c S(q k 1)/N also defines a bilinear pairing G 1 G 2 F q [r]. Both pairings a k S and a twist S non-degenerate if and only if r L. We will show that under certain conditions a suitable choice of S yields pairings a S and a twist S which are more efficient than the Ate pairing a T and the twisted Ate pairing a twist T for T = t 1. For these choices of S we call a S and optimised Ate and optimised twisted Ate pairing. a twist S Proof. The proof is essentially the same as in [11], but slightly more general. We let ψ = π q for the Ate pairing case and ψ = γπ q for the twisted Ate pairing case, where γ Aut(E) is an automorphism of order k such that (γπ q )(Q) = Q and (γπ q )(P ) = [q]p. If we interchange P and Q for the twisted Ate pairing we have ψ(p ) = P, ψ(q) = [q]q = [S]Q and need to consider f S,Q (P ) c S(q k 1)/N like for the Ate pairing. This allows us to deal with both cases in one go. From Lemma 1 of [11] we obtain and Lemma 2 of [1] yields e(q, P ) = f r,q (P ) (qk 1)/r = f N,Q (P ) (qk 1)/N e(q, P ) L = f N,Q (P ) L(qk 1)/N = f LN,Q (P ) (qk 1)/N = f S k 1,Q(P ) (qk 1)/N are = f Sk,Q(P ) (qk 1)/N. (1) f S k,q = fs,q Sk 1 fs,sq Sk 2 f S,S Q. (2) k 1 Since ψ is purely inseparable of degree q, we obtain from Lemma 4 in [11] f S,ψi (Q) ψ i = f qi S,Q. (3) 4
5 We have ψ i (Q) = S i Q and ψ i (P ) = P. Combining this with (2) and (3) gives Substituting (4) into (1) gives Now (5) shows that a S and a twist S if and only if r L. f Sk,Q(P ) = f S,Q (P ) P k 1 i=0 Sk 1 i q i. (4) e(q, P ) L = f S,Q (P ) c S(q k 1)/N. (5) are bilinear pairings, which are non-degenerate If we want to apply the twisted Ate pairing for k Aut(E), we can consider the base extension E 1 of E over F q e, where e = k/ gcd(k, Aut(E)). The embedding degree of E 1 with respect to r is m = k/e, and we have m Aut(E 1 ). We can thus apply the twisted Ate pairing from Theorem 1 to E 1, replacing q by q e, k by m and using S q e mod r. 4 Performance Evaluation We provide some families of elliptic curves admitting a twist of degree 4 and 6, and compare the costs of optimized versions with the standard pairings. 4.1 Polynomial Families Let ρ log p/ log r be the ratio between the bit lengths of the finite field and the order of the subgroup. If D = 1, 2, 3 in CM equation 4p t 2 = DV 2, the following elliptic curves are generated without CM algorithm [9]. E 1 : y 2 = x 3 + ax (D = 1) E 2 : y 2 = x 3 30ax a 3 (D = 2) E 3 : y 2 = x 3 + b (D = 3) where E 1 (respectively E 2 and E 3 ) is a twist of degree 4(respectively 2 and 6). Some polynomial families with square polynomial have been presented such as for k = 4, 6 when ρ 2 [7], for k = 8 when ρ 3/2 [9] and for k = 12 when ρ 1 [4]. These detailed parameterizations are in Appendix. 4.2 Efficiency Comparison We follow the analysis of [12] and compare the Tate pairing f r,p (Q), Ate pairing f T,Q (P ), twisted Ate pairing f T e,p (Q), optimized Ate pairing f S,Q (P ) and optimized twisted Ate pairing f S,P (Q) on ordinary elliptic curves admitting a twist of degree 6 when k = 6, 12 and degree 4 when k = 4, 8. We refer to f N,P (Q) as a Miller-Lite operation and f N,Q (P ) as a Full-Miller operation. We denote the cost of the Miller-Lite operation by C Lite and the cost of the Full-Miller operation by C Full. Assume both operations use projective coordinates. On the form 5
6 Y 2 = X 3 + AX + B, the costs for Miller-operations are estimated as follows [11]. When A = 3: When A = 0: C Lite = (4S 1 + (2e + 7)M 1 + S k + M k ) log 2 N C Full = (4S e + 6M e + 2eM 1 + S k + M k ) log 2 N C Lite = (5S 1 + (2e + 6)M 1 + S k + M k ) log 2 N C Full = (5S e + 6M e + 2eM 1 + S k + M k ) log 2 N where s = 2 i 3 j, M s = 3 i 5 j M 1, S s = M s. Using the parameters in Appendix, we estimate the loop length for each pairings. Table 1. The Costs Required for the Different Pairings Cost(average size t) Security Level Method Standard Optimized k = 4, d = 4 Tate 4960 log 2 p 320 Ate log 2 r 160 twisted Ate k = 6, d = 6 Tate log 2 p 512 Ate log 2 r 256 twisted Ate k = 8, d = 4 Tate log 2 p 384 Ate log 2 r 256 twisted Ate k = 12, d = 6 Tate log 2 p 256 Ate log 2 r 256 twisted Ate Table 1 represents the costs for different pairing on elliptic curves with k = 4, 6, 8, 12. When ρ 2, we have r t and conclude the optimized Ate and optimized twisted Ate pairings are twice as fast as Tate, Ate and twisted Ate pairings. When k = 8 we see that the optimized twisted Ate pairing is more efficient than the optimized Ate pairing. 5 Conclusion We have proposed optimized versions of the Ate and twisted Ate pairing which are always at least as fast as the Tate pairing. We have also showed that our optimized Ate and optimized twisted Ate pairings require a Miller loop of only half the length of the Miller loop of the Ate and twisted Ate pairings, if ordinary elliptic curves admitting twists of degree 4 and degree 6 with ρ 2 are employed. 6
7 References 1. P.S.L.M. Barreto, S. Galbraith, C. O heigeartaigh, and M. Scott, Efficient pairing computation on supersingular abelian varieties, Cryptology eprint Archive, Report 2004/375, P.S.L.M. Barreto, H.Y. Kim, B. Lynn, and M. Scott, Efficient algorithms for pairing-based cryptosystems, Crypto 2002, Lecture Notes on Computer Science, Vol. 2442, pp , P.S.L.M. Barreto, Ben Lynn, and M. Scott, On the Selection of Pairing-Friendly Groups, SAC 2003, Lecture Notes in Computer Science, Vol. 3006, pp17 25, P.S.L.M. Barreto and Michael Naehrig, Pairing-Friendly Elliptic Curve of Prime Order, Cryptology eprint Archive, Report 2005/133, D. Boneh and M. Franklin, Identity-based Encryption from the Weil pairing, CRYPTO 2001, Lecture Notes on Computer Science, Vol. 2139, pp , D. Boneh, B. Lynn and H. Shacham, Short Signatures from Weil pairing, ASI- ACRYPT 2001, Lecture Notes on Computer Science, Vol. 2248, pp , Pu Duan, Shi Cui and Choong Wah Chan, Effective Polynomial Families for Generating More Pairing-friendly Elliptic Curve, Cryptology eprint Archive, Report 2005/236, Iwan Duursma and Hyang-Sook Lee, Tate Pairing Implementation for Hyperelliptic Cruves y 2 = x p x + d, ASIACRYPT 2003, Lecture Notes on Computer Science, Vol. 2894, pp , David Freeman, M. Scott and Edlyn Teske, A taxonomy of pairingfriendly elliptic curves, Cryptology eprint Archive, Report 2006/372, S. Galbraith, K. Harrison and S. Soldera, Implementing the Tate pairing, ANTS V, Lecture Notes on Computer Science, vol.2369, pp , F. Hess, N.P. Smart and F. Vercauteren, The Eta Pairing Revisited, IEEE Transaction on Information Theory, vol.52, pp , NO. 10, OCTOBER N. Koblitz and A. Menezes, Pairing-based cryptography at high security level, Cryptography and Coding: 10th IMA International Conference, Lecture Notes on Computer Science, Vol. 3796, pp13-36, Arjen K. Lenstra, Selecting Cryptographic Key Sizes, Journal of CRYPTOL- OGY, vol.14, No.4, pp , December, R. Sakai, K. Ohgishi and M. Kasahara, Cryptosystems based on pairing, SCIS 2000, M.Scott, Scaling security in pairing-based protocols, Cryptology eprint Archive, Report 2005/139, Michael Scott, Neil Costigan, and Wesam Abdulwahab, Implementing Cryptographic Pairings on Smartcards, Cryptology eprint Archive, Report 2006/144,
8 Appendix We show the following parameterizations for k = 4, 6, 8, 12 [7, 4, 9] and the value of T = t 1 and S = p mod r. k = 4 t = 4z 2 + 2z + 2 r = 4z p = 8z 4 + 6z 2 + 2z + 1 DV 2 = 4z 2 (2z 2 1) 2 T = 4z 2 + 2z + 1 S = 2z k = 6 t = 3z r = 3z 2 3z + 1 p = 9z 4 9z 3 + 9z 2 3z + 1 DV 2 = 3(3z 2 2z + 1) 2 T = 3z 2 S = 3z 1 k = 8 t = 9z 3 3z 2 2z r = 9z z 3 + 8z 2 + 4z + 1 p = 1 4 (81z6 + 54z z z z 2 + 6z + 1) DV 2 = (3z + 1) 2 T = 9z 3 3z 2 2z 1 T 2 = 81z z z z z 2 + 4z + 1 S = T (for optimized Ate pairing) S = p 2 mod r = 18z 3 15z 2 10z 4 (for optimized twisted Ate pairing) k = 12 t = 6z r = 36z z z 2 + 6z + 1 p = 36z z z 2 + 6z + 1 DV 2 = 3(6z 2 + 4z + 1) 2 T = 6z 2 T 2 = 36z 4 S = T (for optimized Ate pairing) S = p 2 mod r = 36z 3 18z 2 6z 1 (for optimized twisted Ate pairing) 8
The Eta Pairing Revisited
1 The Eta Pairing Revisited F. Hess, N.P. Smart and F. Vercauteren Abstract In this paper we simplify and extend the Eta pairing, originally discovered in the setting of supersingular curves by Baretto
More informationThe Eta Pairing Revisited
The Eta Pairing Revisited F. Hess 1, N. Smart 2, and Frederik Vercauteren 3 1 Technische Universität Berlin, Fakultät II, Institut für Mathematik, MA 8-1, Strasse des 17. Juni 136, D-10623 Berlin, Germany.
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationSome Efficient Algorithms for the Final Exponentiation of η T Pairing
Some Efficient Algorithms for the Final Exponentiation of η T Pairing Masaaki Shirase 1, Tsuyoshi Takagi 1, and Eiji Okamoto 2 1 Future University-Hakodate, Japan 2 University of Tsukuba, Japan Abstract.
More informationImplementing Pairing-Based Cryptosystems
Implementing Pairing-Based Cryptosystems Zhaohui Cheng and Manos Nistazakis School of Computing Science, Middlesex University White Hart Lane, London N17 8HR, UK. {m.z.cheng, e.nistazakis}@mdx.ac.uk Abstract:
More informationFast hashing to G2 on pairing friendly curves
Fast hashing to G2 on pairing friendly curves Michael Scott, Naomi Benger, Manuel Charlemagne, Luis J. Dominguez Perez, and Ezekiel J. Kachisa School of Computing Dublin City University Ballymun, Dublin
More informationA Remark on Implementing the Weil Pairing
A Remark on Implementing the Weil Pairing Cheol Min Park 1, Myung Hwan Kim 1 and Moti Yung 2 1 ISaC and Department of Mathematical Sciences, Seoul National University, Korea {mpcm,mhkim}@math.snu.ac.kr
More informationGenerating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves
Generating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves Ezekiel J Kachisa School of Computing Dublin City University Ireland ekachisa@computing.dcu.ie Abstract. Constructing pairing-friendly
More informationAte Pairing on Hyperelliptic Curves
Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT 2007 - Barcelona Pairings Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a
More informationOptimal Pairings. Frederik Vercauteren
Optimal Pairings 1 Frederik Vercauteren Abstract In this paper we introduce the concept of an optimal pairing, which by definition can be computed using only log 2 r/ϕ(k) basic Miller iterations, with
More informationOptimal Pairings. F. Vercauteren
Optimal Pairings F. Vercauteren Department of Electrical Engineering, Katholieke Universiteit Leuven Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee, Belgium frederik.vercauteren@esat.kuleuven.be Abstract.
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationEfficient Tate Pairing Computation Using Double-Base Chains
Efficient Tate Pairing Computation Using Double-Base Chains Chang an Zhao, Fangguo Zhang and Jiwu Huang 1 Department of Electronics and Communication Engineering, Sun Yat-Sen University, Guangzhou 510275,
More informationFINDING COMPOSITE ORDER ORDINARY ELLIPTIC CURVES USING THE COCKS-PINCH METHOD
FINDING COMPOSITE ORDER ORDINARY ELLIPTIC CURVES USING THE COCKS-PINCH METHOD D. BONEH, K. RUBIN, AND A. SILVERBERG Abstract. We apply the Cocks-Pinch method to obtain pairing-friendly composite order
More informationImplementing Cryptographic Pairings over Barreto-Naehrig Curves
Implementing Cryptographic Pairings over Barreto-Naehrig Curves Augusto Jun Devegili 1, Michael Scott 2, and Ricardo Dahab 1 1 Instituto de Computação, Universidade Estadual de Campinas Caixa Postal 6176,
More informationThe Final Exponentiation in Pairing-Based Cryptography
The Final Exponentiation in Pairing-Based Cryptography Barış Bülent Kırlar Department of Mathematics, Süleyman Demirel University, 3220, Isparta, Turkey Institute of Applied Mathematics, Middle East Technical
More informationOn Near Prime-Order Elliptic Curves with Small Embedding Degrees
On Near Prime-Order Elliptic Curves with Small Embedding Degrees Duc-Phong Le, Nadia El Mrabet, Tan Chik How To cite this version: Duc-Phong Le, Nadia El Mrabet, Tan Chik How. On Near Prime-Order Elliptic
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationConstructing Families of Pairing-Friendly Elliptic Curves
Constructing Families of Pairing-Friendly Elliptic Curves David Freeman Information Theory Research HP Laboratories Palo Alto HPL-2005-155 August 24, 2005* cryptography, pairings, elliptic curves, embedding
More informationEfficient and Generalized Pairing Computation on Abelian Varieties
ECC 2008 Efficient and Generalized Pairing Computation on Abelian Varieties Hyang-Sook Lee Ewha Womans University Korea Joint Work with Eunjeong Lee (North Carolina State University) Cheol-Min Park (EWHA)
More informationOn near prime-order elliptic curves with small embedding degrees (Full version)
On near prime-order elliptic curves with small embedding degrees (Full version) Duc-Phong Le 1, Nadia El Mrabet 2, and Chik How Tan 1 1 Temasek Laboratories, National University of Singapore {tslld,tsltch}@nus.edu.sg
More informationGenerating more MNT elliptic curves
Generating more MNT elliptic curves Michael Scott 1 and Paulo S. L. M. Barreto 2 1 School of Computer Applications Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie 2 Universidade
More informationSpeeding up Ate Pairing Computation in Affine Coordinates
Speeding up Ate Pairing Computation in Affine Coordinates Duc-Phong Le and Chik How Tan Temasek Laboratories, National University of Singapore, 5A Engineering Drive 1, #09-02, Singapore 11711. (tslld,tsltch)@nus.edu.sg
More informationBackground of Pairings
Background of Pairings Tanja Lange Department of Mathematics and Computer Science Technische Universiteit Eindhoven The Netherlands tanja@hyperelliptic.org 04.09.2007 Tanja Lange Background of Pairings
More informationOptimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves
CT-RSA 2012 February 29th, 2012 Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves Joint work with: Nicolas Estibals CARAMEL project-team, LORIA, Université de Lorraine / CNRS / INRIA,
More informationEfficient hash maps to G 2 on BLS curves
Efficient hash maps to G 2 on BLS curves Alessandro Budroni 1 and Federico Pintore 2 1 MIRACL Labs, London, England - budroni.alessandro@gmail.com 2 Department of Mathematics, University of Trento, Italy
More informationOrdinary Pairing Friendly Curve of Embedding Degree 3 Whose Order Has Two Large Prime Factors
Memoirs of the Faculty of Engineering, Okayama University, Vol. 44, pp. 60-68, January 2010 Ordinary Pairing Friendly Curve of Embedding Degree Whose Order Has Two Large Prime Factors Yasuyuki NOGAMI Graduate
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationImplementing Cryptographic Pairings on Smartcards
Implementing Cryptographic Pairings on Smartcards Michael Scott, Neil Costigan, and Wesam Abdulwahab School of Computer Applications Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie
More informationEfficient Pairings Computation on Jacobi Quartic Elliptic Curves
Efficient Pairings Computation on Jacobi Quartic Elliptic Curves Sylvain Duquesne 1, Nadia El Mrabet 2, and Emmanuel Fouotsa 3 1 IRMAR, UMR CNRS 6625, Université Rennes 1, Campus de Beaulieu 35042 Rennes
More informationPairings for Cryptographers
Pairings for Cryptographers Steven D. Galbraith 1, Kenneth G. Paterson 1, and Nigel P. Smart 2 1 Information Security Group, Royal Holloway, University of London, Egham, Surrey, TW20 0EX, United Kingdom.
More informationarxiv: v3 [cs.cr] 5 Aug 2014
Further Refinements of Miller Algorithm on Edwards curves Duc-Phong Le, Chik How Tan Temasek Laboratories, National University of Singapore 5A Engineering Drive 1, #09-02, Singapore 117411. arxiv:1305.2694v3
More informationOn compressible pairings and their computation
On compressible pairings and their computation Michael Naehrig 1, Paulo S. L. M. Barreto 2, and Peter Schwabe 1 1 Department of Mathematics and Computer Science Technische Universiteit Eindhoven, P.O.
More informationPairing-Friendly Elliptic Curves of Prime Order
Pairing-Friendly Elliptic Curves of Prime Order Paulo S. L. M. Barreto 1 Michael Naehrig 2 1 University of São Paulo pbarreto@larc.usp.br 2 RWTH Aachen University mnaehrig@ti.rwth-aachen.de SAC 2005 Outline
More informationA Variant of Miller s Formula and Algorithm
A Variant of Miller s Formula and Algorithm John Boxall 1, Nadia El Mrabet 2, Fabien Laguillaumie 3, and Duc-Phong Le 4 1 LMNO Université de Caen Basse-Normandie, France john.boxall@unicaen.fr 2 LIASD
More informationPairings at High Security Levels
Pairings at High Security Levels Michael Naehrig Eindhoven University of Technology michael@cryptojedi.org DoE CRYPTODOC Darmstadt, 21 November 2011 Pairings are efficient!... even at high security levels.
More informationKatherine Stange. Pairing, Tokyo, Japan, 2007
via via Department of Mathematics Brown University http://www.math.brown.edu/~stange/ Pairing, Tokyo, Japan, 2007 Outline via Definition of an elliptic net via Definition (KS) Let R be an integral domain,
More informationSecure Bilinear Diffie-Hellman Bits
Secure Bilinear Diffie-Hellman Bits Steven D. Galbraith 1, Herbie J. Hopkins 1, and Igor E. Shparlinski 2 1 Mathematics Department, Royal Holloway University of London Egham, Surrey, TW20 0EX, UK Steven.Galbraith@rhul.ac.uk,
More informationAnalysis of Optimum Pairing Products at High Security Levels
Analysis of Optimum Pairing Products at High Security Levels Xusheng Zhang and Dongdai Lin Institute of Software, Chinese Academy of Sciences Institute of Information Engineering, Chinese Academy of Sciences
More informationFaster Squaring in the Cyclotomic Subgroup of Sixth Degree Extensions
Faster Squaring in the Cyclotomic Subgroup of Sixth Degree Extensions Robert Granger and Michael Scott School of Computing, Dublin City University, Glasnevin, Dublin 9, Ireland. {rgranger,mike}@computing.dcu.ie
More informationArithmetic operators for pairing-based cryptography
7. Kryptotag November 9 th, 2007 Arithmetic operators for pairing-based cryptography Jérémie Detrey Cosec, B-IT, Bonn, Germany jdetrey@bit.uni-bonn.de Joint work with: Jean-Luc Beuchat Nicolas Brisebarre
More informationEfficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields
Efficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields Sanjit Chatterjee, Palash Sarkar and Rana Barua Cryptology Research Group Applied Statistics Unit Indian
More informationEfficient Algorithms for Pairing-Based Cryptosystems
Efficient Algorithms for Pairing-Based Cryptosystems Paulo S. L. M. Barreto 1, Hae Y. Kim 1, Ben Lynn 2, and Michael Scott 3 1 Universidade de São Paulo, Escola Politécnica. Av. Prof. Luciano Gualberto,
More informationPairings on Generalized Huff Curves
Pairings on Generalized Huff Curves Abdoul Aziz Ciss and Djiby Sow Laboratoire d Algèbre, Codage, Cryptologie, Algèbre et Applications Université Cheikh Anta Diop de Dakar, Sénégal BP: 5005, Dakar Fann
More informationFURTHER REFINEMENT OF PAIRING COMPUTATION BASED ON MILLER S ALGORITHM
Unspecified Journal Volume 00, Number 0, Pages 000 000 S????-????(XX)0000-0 FURTHER REFINEMENT OF PAIRING COMPUTATION BASED ON MILLER S ALGORITHM CHAO-LIANG LIU, GWOBOA HORNG, AND TE-YU CHEN Abstract.
More information2.2. The Weil Pairing on Elliptic Curves If A and B are r-torsion points on some elliptic curve E(F q d ), let us denote the r-weil pairing of A and B
Weil Pairing vs. Tate Pairing in IBE systems Ezra Brown, Eric Errthum, David Fu October 10, 2003 1. Introduction Although Boneh and Franklin use the Weil pairing on elliptic curves to create Identity-
More informationFormulas for cube roots in F 3 m
Discrete Applied Mathematics 155 (2007) 260 270 www.elsevier.com/locate/dam Formulas for cube roots in F 3 m Omran Ahmadi a, Darrel Hankerson b, Alfred Menezes a a Department of Combinatorics and Optimization,
More informationA TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES
A TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES DAVID FREEMAN 1, MICHAEL SCOTT 2, AND EDLYN TESKE 3 1 Department of Mathematics University of California, Berkeley Berkeley, CA 94720-3840 USA dfreeman@math.berkeley.edu
More informationEfficient Pairing Computation on Supersingular Abelian Varieties
Efficient airing Computation on Supersingular Abelian Varieties aulo S. L. M. Barreto 1, Steven Galbraith 2, Colm Ó héigeartaigh 3, and Michael Scott 3 1 Department of Computing and Digital Systems Engineering,
More informationAspects of Pairing Inversion
Aspects of Pairing Inversion S. Galbraith 1, F. Hess 2, and F. Vercauteren 3 1 Mathematics Department, Royal Holloway University of London, Egham, Surrey TW20 0EX, UK. steven.galbraith@rhul.ac.uk 2 Technische
More informationA Generalized Brezing-Weng Algorithm for Constructing Pairing-Friendly Ordinary Abelian Varieties
A Generalized Brezing-Weng Algorithm for Constructing Pairing-Friendly Ordinary Abelian Varieties David Freeman Department of Mathematics University of California, Berkeley Berkeley, CA 94720-3840, USA
More informationPAIRINGS ON HYPERELLIPTIC CURVES. 1. Introduction
PAIRINGS ON HYPERELLIPTIC CURVES JENNIFER BALAKRISHNAN, JULIANA BELDING, SARAH CHISHOLM, KIRSTEN EISENTRÄGER, KATHERINE E. STANGE, AND EDLYN TESKE Dedicated to the memory of Isabelle Déchène (1974-2009)
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things Efficient algorithms Suitable elliptic curves We have got
More informationAspects of Pairing Inversion
Aspects of Pairing Inversion 1 S. Galbraith, and F. Hess, and F. Vercauteren Abstract We discuss some applications of the pairing inversion problem and outline some potential approaches for solving it.
More informationEfficient Algorithms for Pairing-Based Cryptosystems
Efficient Algorithms for Pairing-Based Cryptosystems Paulo S.L.M. Barreto 1, Hae Y. Kim 1, Ben Lynn 2, and Michael Scott 3 1 Universidade de São Paulo, Escola Politécnica Av. Prof. Luciano Gualberto, tr.
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things l Efficient algorithms l Suitable elliptic curves We have
More informationHyperelliptic pairings
Hyperelliptic pairings Steven D. Galbraith 1, Florian Hess 2, and Frederik Vercauteren 3 1 Mathematics Department, Royal Holloway, University of London, Egham, Surrey, TW20 0EX, UK. steven.galbraith@rhul.ac.uk
More informationA Digital Signature Scheme based on two hard problems
A Digital Signature Scheme based on two hard problems Dimitrios Poulakis and Robert Rolland Abstract In this paper we propose a signature scheme based on two intractable problems, namely the integer factorization
More informationA TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES
A TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES DAVID FREEMAN, MICHAEL SCOTT, AND EDLYN TESKE Abstract. Elliptic curves with small embedding degree and large prime-order subgroup are key ingredients for
More informationPairing Computation on Elliptic Curves of Jacobi Quartic Form
Pairing Computation on Elliptic Curves of Jacobi Quartic Form Hong Wang, Kunpeng Wang, Lijun Zhang, and Bao Li {hwang,kpwang,ljzhang,lb}@is.ac.cn State Key Laboratory of Information Security Graduate University
More informationAn Analysis of Affine Coordinates for Pairing Computation
An Analysis of Affine Coordinates for Pairing Computation Michael Naehrig Microsoft Research mnaehrig@microsoft.com joint work with Kristin Lauter and Peter Montgomery Microsoft Research Pairing 2010,
More informationTampering attacks in pairing-based cryptography. Johannes Blömer University of Paderborn September 22, 2014
Tampering attacks in pairing-based cryptography Johannes Blömer University of Paderborn September 22, 2014 1 / 16 Pairings Definition 1 A pairing is a bilinear, non-degenerate, and efficiently computable
More informationUnbalancing Pairing-Based Key Exchange Protocols
Unbalancing Pairing-Based Key Exchange Protocols Michael Scott Certivox Labs mike.scott@certivox.com Abstract. In many pairing-based protocols more than one party is involved, and some or all of them may
More informationAn Analysis of Affine Coordinates for Pairing Computation
An Analysis of Affine Coordinates for Pairing Computation Kristin Lauter, Peter L. Montgomery, and Michael Naehrig Microsoft Research, One Microsoft Way, Redmond, WA 98052, USA {klauter, petmon, mnaehrig}@microsoft.com
More informationOptimal TNFS-secure pairings on elliptic curves with even embedding degree
Optimal TNFS-secure pairings on elliptic curves with even embedding degree Georgios Fotiadis 1 and Chloe Martindale 2 1 University of the Aegean, Greece gfotiadis@aegean.gr 2 Technische Universiteit Eindhoven,
More informationA Dierential Power Analysis attack against the Miller's Algorithm
A Dierential Power Analysis attack against the Miller's Algorithm Nadia El Mrabet (1), G. Di Natale (2) and M.L. Flottes (2) (1) Team Arith, (2) Team CCSI/LIRMM, Université Montpellier 2 Prime 2009, UCC,
More informationCompressed Pairings. 1 School of Computing
Compressed Pairings Michael Scott 1 and Paulo S. L. M. Barreto 2 1 School of Computing Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie 2 Universidade de São Paulo, Escola Politécnica.
More informationA New Family of Pairing-Friendly elliptic curves
A New Family of Pairing-Friendly elliptic curves Michael Scott 1 and Aurore Guillevic 2 1 MIRACL.com 2 Université de Lorraine, CNRS, Inria, LORIA, Nancy, France May 21, 2018 Abstract There have been recent
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationFaster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationAn Introduction to Pairings in Cryptography
An Introduction to Pairings in Cryptography Craig Costello Information Security Institute Queensland University of Technology INN652 - Advanced Cryptology, October 2009 Outline 1 Introduction to Pairings
More informationHardware Acceleration of the Tate Pairing in Characteristic Three
Hardware Acceleration of the Tate Pairing in Characteristic Three P. Grabher and D. Page Institute for Applied Information Processing and Communications, Graz University of Technology, Inffeldgasse 16a,
More informationEfficient Computation of Roots in Finite Fields
Efficient Computation of Roots in Finite Fields PAULO S. L. M. BARRETO (pbarreto@larc.usp.br) Laboratório de Arquitetura e Redes de Computadores (LARC), Escola Politécnica, Universidade de São Paulo, Brazil.
More information[6] was based on the quadratic residuosity problem, whilst the second given by Boneh and Franklin [3] was based on the Weil pairing. Originally the ex
Exponent Group Signature Schemes and Ecient Identity Based Signature Schemes Based on Pairings F. Hess Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol,
More informationImplementing the Weil, Tate and Ate pairings using Sage software
Sage days 10, Nancy, France Implementing the Weil, Tate and Ate pairings using Sage software Nadia EL MRABET LIRMM, I3M, Université Montpellier 2 Saturday 11 th October 2008 Outline of the presentation
More informationID-Based Blind Signature and Ring Signature from Pairings
ID-Based Blind Signature and Ring Signature from Pairings Fangguo Zhang and Kwangjo Kim International Research center for Information Security (IRIS) Information and Communications University(ICU), 58-4
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationGENERATORS OF JACOBIANS OF GENUS TWO CURVES
GENERATORS OF JACOBIANS OF GENUS TWO CURVES CHRISTIAN ROBENHAGEN RAVNSHØJ Abstract. We prove that in most cases relevant to cryptography, the Frobenius endomorphism on the Jacobian of a genus two curve
More informationUSING ABELIAN VARIETIES TO IMPROVE PAIRING-BASED CRYPTOGRAPHY
USING ABELIAN VARIETIES TO IMPROVE PAIRING-BASED CRYPTOGRAPHY K. RUBIN AND A. SILVERBERG Abstract. We show that supersingular abelian varieties can be used to obtain higher MOV security per bit, in all
More informationThe Hidden Root Problem
The Hidden Root Problem F Vercauteren Department of Electrical Engineering, University of Leuven Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee, Belgium frederikvercauteren@esatkuleuvenbe Abstract In
More informationConstructing Abelian Varieties for Pairing-Based Cryptography. David Stephen Freeman. A.B. (Harvard University) 2002
Constructing Abelian Varieties for Pairing-Based Cryptography by David Stephen Freeman A.B. (Harvard University) 2002 A dissertation submitted in partial satisfaction of the requirements for the degree
More informationEfficient computation of pairings on Jacobi quartic elliptic curves
J. Math. Cryptol., Ahead of Print DOI 10.1515/jmc-2013-0033 de Gruyter 2014 Efficient computation of pairings on Jacobi quartic elliptic curves Sylvain Duquesne, Nadia El Mrabet and Emmanuel Fouotsa Communicated
More informationWhat About Vulnerability to a Fault Attack of the Miller s Algorithm during an Identity Based Protocol?
What About Vulnerability to a Fault Attack of the Miller s Algorithm during an Identity Based Protocol? Nadia EL MRABET LIRMM Laboratory, I3M, CNRS, University Montpellier 2, 161, rue Ada, 34 392 Montpellier,
More informationPairings. Florian Hess (Oldenburg) Tel Aviv, February 7, Pairings. F. Hess. Pairings in General. Foundations.
Florian Hess (Oldenburg) Tel Aviv, February 7, 2013 Let G 1, G 2, G T be abelian groups. A pairing is a non-degenerate bilinear map e : G 1 G 2 G T. Bilinearity: e(g 1 + g 2, h) = e(g 1, h)e(g 2, h),
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationPairings for Cryptographers
Pairings for Cryptographers Craig Costello t-craigc@microsoft.com talk based on disjoint work (not mine) by: Steven Galbraith, Kenny Paterson, Nigel Smart August 15, 2012 1 /22 Pairing groups A pairing
More informationEfficient Computation for Pairing Based
Provisional chapter Chapter 3 Efficient Computation for Pairing Based Cryptography: Efficient Computation A Statefor ofpairing the Art Based Cryptography: A State of the Art Nadia El Mrabet Nadia El Mrabet
More informationPairing computation on Edwards curves with high-degree twists
Pairing computation on Edwards curves with high-degree twists Liangze Li 1, Hongfeng Wu 2, Fan Zhang 1 1 LMAM, School of Mathematical Sciences, Peking University, Beijing 100871, China 2 College of Sciences,
More informationTwo Efficient Algorithms for Arithmetic of Elliptic Curves Using Frobenius Map
Two Efficient Algorithms for Arithmetic of Elliptic Curves Using Frobenius Map Jung Hee Cheon, Sungmo Park, Sangwoo Park, and Daeho Kim Electronics and Telecommunications Research Institute, 161 Kajong-Dong,Yusong-Gu,
More informationAn Efficient Signature Scheme from Bilinear Pairings and Its Applications
An Efficient Signature Scheme from Bilinear Pairings and Its Applications Fangguo Zhang, Reihaneh Safavi-Naini and Willy Susilo School of Information Technology and Computer Science University of Wollongong,
More informationAn Efficient Signature Scheme from Bilinear Pairings and Its Applications
An Efficient Signature Scheme from Bilinear Pairings and Its Applications Fangguo Zhang, Reihaneh Safavi-Naini and Willy Susilo School of Information Technology and Computer Science University of Wollongong,
More informationON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS
ON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS GORA ADJ, OMRAN AHMADI, AND ALFRED MENEZES Abstract. We study the isogeny graphs of supersingular elliptic curves over finite fields,
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat 1, Nicolas Brisebarre 2,3, Jérémie Detrey 3, and Eiji Okamoto 1 1 Laboratory of Cryptography and Information Security, University of
More informationThe Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms
The Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms by Michael Shantz A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationMappings of elliptic curves
Mappings of elliptic curves Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Isogenies of Elliptic Curves
More informationOn the distribution of irreducible trinomials over F 3
Finite Fields and Their Applications 13 (2007) 659 664 http://www.elsevier.com/locate/ffa On the distribution of irreducible trinomials over F 3 Omran Ahmadi Department of Combinatorics and Optimization,
More information標数 3 の超特異楕円曲線上の ηt ペアリングの高速実装
九州大学学術情報リポジトリ Kyushu University Institutional Repository 標数 3 の超特異楕円曲線上の ηt ペアリングの高速実装 川原, 祐人九州大学大学院数理学府 https://doi.org/10.15017/21704 出版情報 :Kyushu University, 2011, 博士 ( 機能数理学 ), 課程博士バージョン :published
More information